Consumers and businesses face a growing tide of malicious software that threatens the stability and performance of their computers and the security of their data. Computer programmers with malicious motivations have created and continue to create viruses, Trojan horses, worms, and other programs (collectively known as “malware”) in an attempt to compromise computer systems. In an attempt to evade detection, malicious programmers may inject malware into or among legitimate programs.
Many security software companies attempt to combat malware by creating and deploying malware signatures (e.g., hash functions that uniquely identify malware) to their customers on a regular basis. However, a significant amount of malware has not yet been identified and therefore cannot be detected using traditional signature-based malware-detection mechanisms, particularly since malware authors may regularly modify their malware in an attempt to circumvent commonly employed signature-based malware-detection mechanisms.
Additionally, some malware may pose as programs known to be legitimate (e.g., to disguise its presence from users and avoid removal). In some cases, these imposter programs may place additional malware on computing systems, and traditional signature-based methods of detection may fail to detect some or all of the additional malware. Accordingly, the instant disclosure identifies and addresses a need for additional and improved systems and methods for securing computing devices against imposter processes.